# MAL-2026-6698: Malicious code in cursed-modules (npm)


- **Type:** Malicious package
- **Package:** `cursed-modules` (npm)
- **Published:** 30 Jun 2026

## What is MAL-2026-6698?

MAL-2026-6698 is a malicious package in cursed-modules, published on 30 Jun 2026. 

### Official description

cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded bare-IP C2 at 154.57.164.70.

1) Install-time exfiltration: package.json wires preinstall, install, and postinstall all to `node install.js`. install.js reads /flag, /flag.txt, /app/flag.txt, /root/flag.txt, environment variables (including FLAG/HTB_FLAG), runs `id` and `hostname`, greps the filesystem for CTF flag patterns, serializes process.env, base64-encodes the payload wrapped in a fake `ecto_module` YAML manifest, and HTTP PUTs it to 154.57.164.70:31682/api/modules/ECT-987654.

2) Require-time AWS credential theft: index.js (the declared `main`) runs an IIFE on require that, when the hostname matches a Docker container ID pattern, invokes `aws sts get-caller-identity`, fetches IAM credentials from the IMDS endpoint http://169.254.169.254/latest/meta-data/iam/security-credentials/, lists Secrets Manager secrets, reads /home/node sources and flag files, dumps process.env, and PUTs the base64-encoded result to 154.57.164.70:32447/api/modules/ECT-654321.

3) Broader recon: recon.js reads /root/.npmrc, /home/user/.npmrc, project package.json/lock files, verdaccio configs, htpasswd files, cron jobs, and supervisord configs, then PUTs the data (with a curl fallback) to 154.57.164.70:30728/api/modules/ECT-654321 — directly harvesting npm registry tokens and private-registry credentials.

4) Backdoor: rce.sh PUTs an arbitrary shell command to 154.57.164.70:32447 under module slot ECT-654321 and GETs the base64 command output from slot ECT-987654, completing a request/response command relay over the same C2.

The package self-identifies (publish-and-arm.sh, install.js manifest) as a deliberate dependency-confusion attack against verdaccio proxies; the 999.0.9 version is consistent with that pattern. Three independent lifecycle hooks plus a require-time IIFE guarantee the payload fires on default `npm install` and on any consumption of the module.

The OpenSSF Package Analysis project identified 'cursed-modules' @ 999.0.0 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

## What should I do about MAL-2026-6698?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6698 is a malicious package: cursed-modules (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6698/ (Markdown: https://insights.sbomify.com/MAL-2026-6698/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6698

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6698/
Summaries are generated and may contain mistakes; the official description above is the record.